Merge branch 'feature/rbac-02-policy-enforcement-schicht-zentral' into feature/qa-04-sicherheits-penetrationspruefung-core

# Conflicts:
#	scripts/reset-test-env.sh

migrations/0003_policy_rules.down.sql

@@ -0,0 +1,2 @@
+DROP TABLE IF EXISTS policy_rule_changes;
+DROP TABLE IF EXISTS policy_rules;

migrations/0003_policy_rules.up.sql

@@ -0,0 +1,24 @@
+-- Zentrale, deklarative Policy-Regeln (RBAC-02, siehe core-kanban/tickets/RBAC-02.md).
+-- policy_rules haelt den AKTUELLEN, gewaehrten Regelsatz (Existenz = erlaubt,
+-- Default-Deny fuer alles ohne Zeile). policy_rule_changes ist die
+-- versionierte Aenderungshistorie (Akzeptanzkriterium 3: Regelwechsel ohne
+-- Codeaenderung nachvollziehbar).
+CREATE TABLE policy_rules (
+    role       TEXT NOT NULL,
+    permission TEXT NOT NULL,
+    granted_by TEXT NOT NULL,
+    granted_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    PRIMARY KEY (role, permission)
+);
+
+CREATE TABLE policy_rule_changes (
+    id         UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    role       TEXT NOT NULL,
+    permission TEXT NOT NULL,
+    action     TEXT NOT NULL CHECK (action IN ('grant', 'revoke')),
+    actor      TEXT NOT NULL,
+    version    INT NOT NULL,
+    changed_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX policy_rule_changes_idx ON policy_rule_changes (role, permission, version);